@zewstid/zeye-capture 0.2.0 → 0.3.0

package/README.md

@@ -5,9 +5,20 @@ capture is the default. Complete provider-visible prompts, responses and tool
 records are captured only after explicit Zeye consent and local secret
 redaction. Hidden model reasoning is never captured.
 
+Install the public CLI with Node 20.18.1 or newer:
+
+```sh
+npm install --global @zewstid/zeye-capture@0.3.0
+```
+
+Capture `0.3.x` uses the `@zewstid/zeye-shared` `0.5.x` contracts.
+
 ## What exists now
 
-- `FileOutbox`: a JSON-backed durable outbox with atomic state replacement.
+- `FileOutbox`: an atomic durable outbox. Consented transcript fields are
+  authenticated AES-256-GCM ciphertext at rest; the separate local key and
+  queue are owner-only. Existing v1 plaintext queues are encrypted in place on
+  their first read before any record is returned.
 - Idempotent delivery records keyed by `adapter + sessionId + sourceEventId`,
   including immutable repository/branch/HEAD facts observed at enqueue time.
 - Stable content hashes: replays with the same source and content collapse;
@@ -18,8 +29,12 @@ redaction. Hidden model reasoning is never captured.
   to replay safely after an offline period.
 - Claude Code hook and Codex JSONL adapters for lifecycle metadata and,
   when explicitly consented, provider-visible messages and tool records.
-- A one-command background service that continuously imports and retries on
+- A one-command, machine-level background service that continuously imports and retries on
   macOS (launchd), Linux (systemd user service), and Windows (Task Scheduler).
+  The host continuously discovers repositories from installed Claude/Codex
+  adapters as well as explicit Zeye bindings. One `service install` is enough;
+  repositories configured later join the same service automatically, and Git
+  worktrees remain independent roots.
 - `CaptureHttpTransport`, which turns one durable local delivery into one
   authenticated, idempotent `POST /engineering-memory/ingest` batch.
 - A production-oriented local CLI: Claude Code hook install/removal, configured
@@ -29,8 +44,15 @@ redaction. Hidden model reasoning is never captured.
 ## Security and limits
 
 - Transcript content is locally redacted before either the durable outbox or
-  network boundary. The API envelope-encrypts each segment with a separate data
-  key and keeps ciphertext apart from metadata.
+  network boundary. It is then AES-256-GCM encrypted in the local queue with a
+  generated owner-only sidecar key. Authentication binds ciphertext to its
+  delivery/source/payload identity, transcript-bearing idempotency digests are
+  keyed HMACs rather than guessable plain hashes, and missing or altered
+  keys/ciphertext fail closed. The API independently envelope-encrypts each
+  uploaded segment.
+- Every queued content record is bound to the consent ID active at capture.
+  Removing or replacing that consent stops replay; the client never silently
+  re-labels offline content under a later consent.
 - The one-time enrollment token is kept in an owner-only local service config,
   never in the service definition, command line, repository, or outbox. Native
   keychain integration remains future hardening.
@@ -128,10 +150,14 @@ zeye-capture status
 zeye-capture heartbeat
 
 # With ZEYE_CAPTURE_* values present, install and immediately start continuous
-# sync. The service survives logout/restart according to the host OS policy.
+# sync. Repositories with a Zeye Claude hook or Codex source are discovered
+# automatically, including ones configured after startup. Re-run only when an
+# explicit internal Zeye repository binding is needed. The service survives
+# logout/restart according to the host OS policy.
 zeye-capture service install --repo /path/to/repo
 
-# Stop continuous sync and remove both its definition and private enrollment.
+# Unregister one checkout. The host and credential remain until the final
+# registered checkout is removed.
 zeye-capture service uninstall --repo /path/to/repo
 
 # Remove only hook groups/sources created for Zeye.
@@ -143,8 +169,16 @@ zeye-capture uninstall codex --jsonl /absolute/path/to/rollout.jsonl
 modify that file if Git tracks it. It preserves other hook groups. The host
 configuration is stored under `$XDG_CONFIG_HOME/zeye-capture/host-v1.json` (or
 `~/.config/...`) with owner-only permissions where the OS supports POSIX modes.
-The default outbox is under `$XDG_STATE_HOME/zeye-capture/` (or
-`~/.local/state/...`) and is also owner-restricted. `ZEYE_CAPTURE_OUTBOX_DIR`,
+The default outbox and its separate 256-bit encryption key are under
+`$XDG_STATE_HOME/zeye-capture/` (or `~/.local/state/...`) and are also
+owner-restricted. Back up or protect both together: the key is deliberately
+not recoverable from Zeye, and capture fails closed if it is missing. It never
+generates a replacement key over an encrypted queue. Deliberately deleting the
+key is cryptographic revocation of all transcript content in that repository's
+queue and is irreversible; remove the corresponding queue as an explicit
+separate cleanup action. Native OS keychain/credential-vault storage is not
+claimed in this release—the fallback is an owner-only local key file.
+`ZEYE_CAPTURE_OUTBOX_DIR`,
 when set, is a private base directory: Zeye creates a distinct hashed child for
 each repository so records cannot cross repository boundaries. Neither location
 stores the upload token.
@@ -155,7 +189,7 @@ by hand:
 
 ```text
 ZEYE_CAPTURE_ENDPOINT=https://api.example/engineering-memory/ingest
-ZEYE_CAPTURE_TOKEN=zem_...                 # runtime only; never written by CLI
+ZEYE_CAPTURE_TOKEN=zem_...                 # persisted only by service install in its owner-only enrollment
 ZEYE_CAPTURE_ORGANIZATION_ID=...
 ZEYE_CAPTURE_INSTALLATION_ID=...
 ZEYE_CAPTURE_ACTOR_JSON={...}
@@ -177,7 +211,18 @@ available; the raw remote URL is not stored or printed. A configured internal
 repository ID enables the server to bind those facts to existing Zeye evidence.
 
 For continuous capture, run `zeye-capture service install --repo /path/to/repo`
-once. The CLI
+once. The CLI maintains one machine-level service and combines its private
+binding registry with repository roots already configured by Claude and Codex,
+instead of creating one scheduler per repo. Raw paths remain local and are
+never sent in the capture protocol; only canonical repository facts and
+one-way hashes cross the network boundary.
+Discovery is bounded to the Zeye-owned local adapter registry and explicit
+enrollment roots. It does not crawl the home directory, workspace folders or
+Git remotes. Discovery also grants no server permission: the API still resolves
+the repository inside the installation's tenant and approved repository scope.
+Each repository keeps its own outbox, lock, Git identity and optional Zeye
+repository binding, so offline replay is idempotent and cannot cross repository
+boundaries. The CLI
 uses an owner-only single-process lock and waits briefly for an overlapping
 hook/run before failing, so normal bursts are queued rather than dropped. A
 `sync` exits non-zero if an input source or upload fails, while retaining its

package/dist/src/cli.js

@@ -49,17 +49,17 @@ async function readStdin() {
         chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
     return Buffer.concat(chunks).toString("utf8");
 }
-async function resolveRepository(repoPath) {
+async function resolveRepository(repoPath, binding) {
     const identity = await (0, localHost_1.discoverRepositoryIdentity)(repoPath, {
-        providerRepositoryId: process.env.ZEYE_CAPTURE_PROVIDER_REPOSITORY_ID,
+        providerRepositoryId: binding?.providerRepositoryId || process.env.ZEYE_CAPTURE_PROVIDER_REPOSITORY_ID,
     });
     if (!identity)
         throw new Error(`No Git repository found at ${repoPath}. Run this command from a repository or pass --repo PATH.`);
     return identity;
 }
-function captureContext(identity) {
+function captureContext(identity, binding) {
     return {
-        repositories: (0, localHost_1.captureRepositoryReference)(identity, process.env.ZEYE_CAPTURE_REPOSITORY_ID),
+        repositories: (0, localHost_1.captureRepositoryReference)(identity, binding?.repositoryId || process.env.ZEYE_CAPTURE_REPOSITORY_ID),
     };
 }
 async function runtimeConfig(identity) {
@@ -110,11 +110,17 @@ async function flushIfConfigured(outbox, configuration, adapter) {
     await transport.publishManifest((0, transport_1.capabilityManifestForAdapter)(adapter, Boolean(configuration.privacy.contentConsentId)));
     return { uploadConfigured: true, ...(await transport.flush()) };
 }
-async function withRepositoryCapture(identity, operation) {
+async function withRepositoryCapture(identity, operation, binding) {
     const directory = (0, localHost_1.localOutboxDirectory)(identity.repositoryRoot);
-    const context = captureContext(identity);
+    const repositoryContext = captureContext(identity, binding);
     return (0, localHost_1.withCaptureLock)(directory, async () => {
         const runtime = await runtimeConfig(identity);
+        const context = {
+            ...repositoryContext,
+            ...(runtime?.privacy.contentConsentId
+                ? { contentConsentId: runtime.privacy.contentConsentId }
+                : {}),
+        };
         return operation(new fileOutbox_1.FileOutbox(directory, runtime?.privacy.contentMode === "REDACTED_CONTENT"
             ? redaction_1.consentedTranscriptRedactor
             : redaction_1.metadataRedactor), runtime, context);
@@ -154,12 +160,12 @@ async function status(repositoryRoot) {
         diagnostics: configured
             ? []
             : [
-                "Upload is offline-only until all ZEYE_CAPTURE_* runtime variables are supplied. The token is never stored by this CLI.",
+                "No runtime enrollment is configured for this process; captured records remain in the private local outbox.",
             ],
     });
 }
-async function sync(repositoryRoot, exitOnFailure = true) {
-    const identity = await resolveRepository(repositoryRoot);
+async function sync(repositoryRoot, exitOnFailure = true, binding) {
+    const identity = await resolveRepository(repositoryRoot, binding);
     const config = await (0, localHost_1.readLocalHostConfig)();
     const sources = (0, localHost_1.configuredSourcesForRepository)(config, identity.repositoryRoot);
     const result = await withRepositoryCapture(identity, async (outbox, runtime, context) => {
@@ -211,7 +217,7 @@ async function sync(repositoryRoot, exitOnFailure = true) {
                 error: error instanceof Error ? error.message : "capture_sync_failed",
             };
         }
-    });
+    }, binding);
     print(result);
     if (exitOnFailure &&
         (result.imports.some((entry) => entry.error) ||
@@ -258,6 +264,13 @@ function serviceEnrollment(intervalSeconds) {
             : {}),
     };
 }
+function repositoryBinding(identity) {
+    return {
+        repositoryRoot: identity.repositoryRoot,
+        ...(process.env.ZEYE_CAPTURE_REPOSITORY_ID?.trim() ? { repositoryId: process.env.ZEYE_CAPTURE_REPOSITORY_ID.trim() } : {}),
+        ...(identity.providerRepositoryId ? { providerRepositoryId: identity.providerRepositoryId } : {}),
+    };
+}
 async function runService(repositoryRoot, configPath) {
     const enrollment = await (0, service_1.readServiceEnrollment)(configPath);
     (0, service_1.applyServiceEnrollment)(enrollment);
@@ -269,7 +282,18 @@ async function runService(repositoryRoot, configPath) {
         stopping = true;
     });
     while (!stopping) {
-        await sync(repositoryRoot, false);
+        // Re-read adapter configuration every cycle. Repositories configured for
+        // Claude/Codex after the service started are discovered without another
+        // scheduler or service enrollment edit.
+        const repositories = (0, service_1.discoverServiceRepositories)(enrollment.repositories, await (0, localHost_1.readLocalHostConfig)(), repositoryRoot);
+        for (const repository of repositories) {
+            if (stopping)
+                break;
+            // A checkout may be temporarily unavailable (detached volume, deleted
+            // worktree, sleeping network mount). Keep servicing every other
+            // registered repository; its durable outbox will replay when it returns.
+            await sync(repository.repositoryRoot, false, repository).catch(() => undefined);
+        }
         if (stopping)
             break;
         await new Promise((resolveWait) => setTimeout(resolveWait, enrollment.intervalSeconds * 1000));
@@ -283,7 +307,7 @@ async function main() {
         const configPath = optional(flags, "config");
         if (!configPath)
             throw new Error("Service configuration is required");
-        await runService(repoPath, configPath);
+        await runService(optional(flags, "repo"), configPath);
         return;
     }
     if (command === "service") {
@@ -298,9 +322,12 @@ async function main() {
             if (process.env.ZEYE_CAPTURE_CONTENT_CONSENT_ID &&
                 process.env.ZEYE_CAPTURE_TRANSCRIPT_CONSENT !== "yes")
                 throw new Error("Transcript service installation requires ZEYE_CAPTURE_TRANSCRIPT_CONSENT=yes");
-            const files = await (0, service_1.installCaptureService)({
-                repositoryRoot: identity.repositoryRoot,
-                enrollment: serviceEnrollment(intervalSeconds),
+            const filesForHost = (0, service_1.hostServiceFiles)();
+            const prior = await (0, service_1.readServiceEnrollment)(filesForHost.enrollmentPath).catch(() => undefined);
+            const binding = repositoryBinding(identity);
+            const repositories = (0, service_1.mergeRepositoryRegistry)(prior?.repositories, binding);
+            const files = await (0, service_1.installCaptureHostService)({
+                enrollment: { ...serviceEnrollment(intervalSeconds), repositories },
                 cliPath: (0, node_path_1.resolve)(process.argv[1]),
             });
             print({
@@ -308,12 +335,21 @@ async function main() {
                 service: files.serviceId,
                 kind: files.kind,
                 intervalSeconds,
+                registeredRepositories: repositories.length,
                 transcriptCapture: Boolean(process.env.ZEYE_CAPTURE_CONTENT_CONSENT_ID),
             });
             return;
         }
         if (action === "uninstall") {
-            const files = await (0, service_1.uninstallCaptureService)(identity.repositoryRoot);
+            const filesForHost = (0, service_1.hostServiceFiles)();
+            const prior = await (0, service_1.readServiceEnrollment)(filesForHost.enrollmentPath).catch(() => undefined);
+            const repositories = (prior?.repositories || []).filter(repository => repository.repositoryRoot !== identity.repositoryRoot);
+            if (prior && repositories.length) {
+                await (0, service_1.installCaptureHostService)({ enrollment: { ...prior, repositories }, cliPath: (0, node_path_1.resolve)(process.argv[1]) });
+                print({ unregistered: true, service: filesForHost.serviceId, registeredRepositories: repositories.length, credentialsRemoved: false });
+                return;
+            }
+            const files = await (0, service_1.uninstallCaptureHostService)();
             print({
                 uninstalled: true,
                 service: files.serviceId,

package/dist/src/fileOutbox.d.ts

@@ -2,6 +2,7 @@ import type { CaptureEvent, CaptureDeliveryContext, DeliveryRecord, DurableOutbo
 export declare class FileOutbox implements DurableOutbox {
     private readonly redactor;
     private readonly statePath;
+    private readonly keyPath;
     private writeQueue;
     constructor(directory: string, redactor: RedactionBoundary);
     enqueue(event: CaptureEvent, context?: CaptureDeliveryContext): Promise<EnqueueResult>;
@@ -15,6 +16,12 @@ export declare class FileOutbox implements DurableOutbox {
     private update;
     private readState;
     private writeState;
+    private encryptState;
+    private decryptState;
+    private readEncryptionKey;
+    private encryptionBinding;
+    private encryptTranscript;
+    private decryptTranscript;
     private sourceKey;
     private checkpointKey;
     private requireDelivery;

package/dist/src/fileOutbox.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FileOutbox = void 0;
+const node_crypto_1 = require("node:crypto");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = require("node:path");
 const canonical_1 = require("./canonical");
@@ -9,14 +10,19 @@ const EMPTY_STATE = { version: 1, deliveries: {}, checkpoints: {} };
 class FileOutbox {
     redactor;
     statePath;
+    keyPath;
     writeQueue = Promise.resolve();
     constructor(directory, redactor) {
         this.redactor = redactor;
         this.statePath = (0, node_path_1.join)(directory, 'outbox-v1.json');
+        this.keyPath = (0, node_path_1.join)(directory, 'outbox-v1.key');
     }
     async enqueue(event, context) {
         this.validateEvent(event);
         const redacted = await this.redactor.redact(event);
+        if (redacted.transcript && !context?.contentConsentId?.trim()) {
+            throw new Error('A content consent ID is required before transcript content can enter the durable outbox');
+        }
         // Parse and clone the context before it reaches durable storage. This keeps
         // provider event IDs and the repository checkout facts in the same
         // idempotency boundary without retaining a raw remote URL or local path.
@@ -24,7 +30,7 @@ class FileOutbox {
             ? zeye_shared_1.CaptureRepositoryReference.array().max(100).parse(context.repositories).map(repository => ({ ...repository }))
             : undefined;
         const sourceKey = this.sourceKey(event);
-        const payloadHash = (0, canonical_1.sha256)({
+        const hashInput = {
             adapter: event.adapter,
             sessionId: event.sessionId,
             sourceEventId: event.sourceEventId,
@@ -33,12 +39,19 @@ class FileOutbox {
             ...(event.sourceGenerationId ? { sourceGenerationId: event.sourceGenerationId } : {}),
             ...(event.relationship ? { relationship: event.relationship } : {}),
             ...(event.relatedSourceSessionId ? { relatedSourceSessionId: event.relatedSourceSessionId } : {}),
+            ...(redacted.transcript ? { contentConsentId: context.contentConsentId.trim() } : {}),
             type: event.type,
             occurredAt: event.occurredAt,
             ...(captureRepositories ? { captureRepositories } : {}),
             payload: redacted.payload,
             ...(redacted.transcript ? { transcript: redacted.transcript } : {}),
-        });
+        };
+        // A plain digest of short transcript text can be guessed offline. Use the
+        // local outbox key as an HMAC key whenever content is present; metadata-only
+        // hashes retain their portable deterministic behavior.
+        const payloadHash = redacted.transcript
+            ? (0, node_crypto_1.createHmac)('sha256', await this.readEncryptionKey(true)).update((0, canonical_1.canonicalJson)(hashInput), 'utf8').digest('hex')
+            : (0, canonical_1.sha256)(hashInput);
         return this.update(async (state) => {
             const existing = Object.values(state.deliveries).find(record => record.sourceKey === sourceKey || (event.deliveryId !== undefined && record.deliveryId === event.deliveryId));
             if (existing) {
@@ -62,6 +75,7 @@ class FileOutbox {
                 ...(event.sourceGenerationId ? { sourceGenerationId: event.sourceGenerationId } : {}),
                 relationship: event.relationship || 'ROOT',
                 ...(event.relatedSourceSessionId ? { relatedSourceSessionId: event.relatedSourceSessionId } : {}),
+                ...(redacted.transcript ? { contentConsentId: context.contentConsentId.trim() } : {}),
                 type: event.type,
                 sequence,
                 occurredAt: event.occurredAt,
@@ -170,9 +184,19 @@ class FileOutbox {
         try {
             const content = await (0, promises_1.readFile)(this.statePath, 'utf8');
             const parsed = JSON.parse(content);
-            if (parsed.version !== 1 || !parsed.deliveries || !parsed.checkpoints)
+            if (!parsed.deliveries || !parsed.checkpoints)
                 throw new Error('Unsupported or corrupt outbox state');
-            return parsed;
+            if (parsed.version === 2)
+                return this.decryptState(parsed);
+            if (parsed.version !== 1)
+                throw new Error('Unsupported or corrupt outbox state');
+            // v1 queues may contain locally redacted but plaintext transcript text.
+            // Rewrite them before returning any records so a read-only status/sync
+            // invocation also completes the migration. A failed key write leaves the
+            // original queue untouched and fails closed.
+            const legacy = parsed;
+            await this.writeState(legacy);
+            return legacy;
         }
         catch (error) {
             if (error.code === 'ENOENT')
@@ -182,9 +206,114 @@ class FileOutbox {
     }
     async writeState(state) {
         await (0, promises_1.mkdir)((0, node_path_1.dirname)(this.statePath), { recursive: true, mode: 0o700 });
+        await (0, promises_1.chmod)((0, node_path_1.dirname)(this.statePath), 0o700).catch(() => undefined);
         const temporaryPath = `${this.statePath}.${process.pid}.${Date.now()}.tmp`;
-        await (0, promises_1.writeFile)(temporaryPath, `${(0, canonical_1.canonicalJson)(state)}\n`, { encoding: 'utf8', mode: 0o600 });
+        const diskState = await this.encryptState(state);
+        await (0, promises_1.writeFile)(temporaryPath, `${(0, canonical_1.canonicalJson)(diskState)}\n`, { encoding: 'utf8', mode: 0o600 });
         await (0, promises_1.rename)(temporaryPath, this.statePath);
+        await (0, promises_1.chmod)(this.statePath, 0o600).catch(() => undefined);
+    }
+    async encryptState(state) {
+        const containsTranscript = Object.values(state.deliveries).some(record => Boolean(record.transcript));
+        const key = containsTranscript ? await this.readEncryptionKey(true) : undefined;
+        const deliveries = {};
+        for (const [deliveryId, record] of Object.entries(state.deliveries)) {
+            const { transcript, ...metadata } = record;
+            deliveries[deliveryId] = {
+                ...metadata,
+                ...(transcript && key ? { encryptedTranscript: this.encryptTranscript(transcript, record, key) } : {}),
+            };
+        }
+        return { version: 2, deliveries, checkpoints: structuredClone(state.checkpoints) };
+    }
+    async decryptState(state) {
+        const containsTranscript = Object.values(state.deliveries).some(record => Boolean(record.encryptedTranscript));
+        const key = containsTranscript ? await this.readEncryptionKey(false) : undefined;
+        const deliveries = {};
+        for (const [deliveryId, record] of Object.entries(state.deliveries)) {
+            const { encryptedTranscript, ...metadata } = record;
+            deliveries[deliveryId] = {
+                ...metadata,
+                ...(encryptedTranscript && key
+                    ? { transcript: this.decryptTranscript(encryptedTranscript, metadata, key) }
+                    : {}),
+            };
+        }
+        return { version: 1, deliveries, checkpoints: structuredClone(state.checkpoints) };
+    }
+    async readEncryptionKey(create) {
+        try {
+            const key = await (0, promises_1.readFile)(this.keyPath);
+            if (key.length !== 32)
+                throw new Error('Capture outbox encryption key is invalid');
+            return key;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            if (!create)
+                throw new Error('Capture outbox encryption key is missing; encrypted records cannot be read');
+        }
+        await (0, promises_1.mkdir)((0, node_path_1.dirname)(this.keyPath), { recursive: true, mode: 0o700 });
+        await (0, promises_1.chmod)((0, node_path_1.dirname)(this.keyPath), 0o700).catch(() => undefined);
+        const key = (0, node_crypto_1.randomBytes)(32);
+        try {
+            const handle = await (0, promises_1.open)(this.keyPath, 'wx', 0o600);
+            try {
+                await handle.writeFile(key);
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await (0, promises_1.chmod)(this.keyPath, 0o600).catch(() => undefined);
+            return key;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            const existing = await (0, promises_1.readFile)(this.keyPath);
+            if (existing.length !== 32)
+                throw new Error('Capture outbox encryption key is invalid');
+            return existing;
+        }
+    }
+    encryptionBinding(record) {
+        return Buffer.from(`${record.deliveryId}\0${record.sourceKey}\0${record.payloadHash}`, 'utf8');
+    }
+    encryptTranscript(transcript, record, key) {
+        const iv = (0, node_crypto_1.randomBytes)(12);
+        const cipher = (0, node_crypto_1.createCipheriv)('aes-256-gcm', key, iv);
+        cipher.setAAD(this.encryptionBinding(record));
+        const ciphertext = Buffer.concat([cipher.update((0, canonical_1.canonicalJson)(transcript), 'utf8'), cipher.final()]);
+        return {
+            version: 1,
+            algorithm: 'A256GCM',
+            keyId: (0, node_crypto_1.createHash)('sha256').update(key).digest('hex').slice(0, 16),
+            iv: iv.toString('base64'),
+            authTag: cipher.getAuthTag().toString('base64'),
+            ciphertext: ciphertext.toString('base64'),
+        };
+    }
+    decryptTranscript(encrypted, record, key) {
+        if (encrypted.version !== 1 || encrypted.algorithm !== 'A256GCM')
+            throw new Error('Unsupported capture outbox transcript encryption');
+        const keyId = (0, node_crypto_1.createHash)('sha256').update(key).digest('hex').slice(0, 16);
+        if (encrypted.keyId !== keyId)
+            throw new Error('Capture outbox encryption key does not match this queue');
+        try {
+            const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', key, Buffer.from(encrypted.iv, 'base64'));
+            decipher.setAAD(this.encryptionBinding(record));
+            decipher.setAuthTag(Buffer.from(encrypted.authTag, 'base64'));
+            const plaintext = Buffer.concat([
+                decipher.update(Buffer.from(encrypted.ciphertext, 'base64')),
+                decipher.final(),
+            ]).toString('utf8');
+            return JSON.parse(plaintext);
+        }
+        catch {
+            throw new Error('Capture outbox transcript authentication failed');
+        }
     }
     sourceKey(event) {
         return `${event.adapter}:${event.sessionId}:${event.sourceGenerationId || event.sessionId}:${event.sourceEventId}`;

package/dist/src/localHost.d.ts

@@ -8,6 +8,7 @@ export type RepositoryIdentity = {
     branch?: string;
     headCommitSha?: string;
     remoteUrlHash?: string;
+    worktreePathHash?: string;
 };
 export type LocalHostConfig = {
     version: 1;

package/dist/src/localHost.js

@@ -17,6 +17,7 @@ exports.uninstallCodexSource = uninstallCodexSource;
 exports.configuredSourcesForRepository = configuredSourcesForRepository;
 const promises_1 = require("node:fs/promises");
 const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const node_util_1 = require("node:util");
@@ -111,6 +112,9 @@ async function discoverRepositoryIdentity(repositoryPath, options = {}) {
         branch: branch || undefined,
         headCommitSha: headCommitSha && /^[a-f0-9]{7,64}$/i.test(headCommitSha) ? headCommitSha : undefined,
         remoteUrlHash: remote ? (0, canonical_1.sha256)(remote) : undefined,
+        // Same one-way worktree identity used by the MCP bridge. The local path is
+        // never uploaded, but simultaneous worktrees remain independently scoped.
+        worktreePathHash: (0, node_crypto_1.createHash)('sha256').update(repositoryRoot, 'utf8').digest('hex'),
     };
 }
 function captureRepositoryReference(identity, repositoryId) {
@@ -121,6 +125,7 @@ function captureRepositoryReference(identity, repositoryId) {
         ...(identity.providerRepositoryId ? { providerRepositoryId: identity.providerRepositoryId } : {}),
         ...(identity.fullName ? { canonicalName: identity.fullName } : {}),
         ...(identity.remoteUrlHash ? { remoteUrlHash: identity.remoteUrlHash } : {}),
+        ...(identity.worktreePathHash ? { worktreePathHash: identity.worktreePathHash } : {}),
         ...(identity.branch ? { branch: identity.branch } : {}),
         ...(identity.headCommitSha ? { headCommitSha: identity.headCommitSha } : {}),
         isPrimary: true,

package/dist/src/service.d.ts

@@ -1,3 +1,4 @@
+import type { LocalHostConfig } from './localHost';
 export type ServiceEnrollment = {
     endpoint: string;
     token: string;
@@ -7,6 +8,11 @@ export type ServiceEnrollment = {
     contentConsentId?: string;
     transcriptConsent?: 'yes';
     intervalSeconds: number;
+    repositories?: Array<{
+        repositoryRoot: string;
+        repositoryId?: string;
+        providerRepositoryId?: string;
+    }>;
 };
 export type ServiceFiles = {
     serviceId: string;
@@ -14,7 +20,21 @@ export type ServiceFiles = {
     definitionPath: string;
     kind: 'launchd' | 'systemd' | 'windows-task';
 };
-export declare function serviceFiles(repositoryRoot: string, environment?: NodeJS.ProcessEnv, os?: NodeJS.Platform): ServiceFiles;
+export declare function mergeRepositoryRegistry(existing: NonNullable<ServiceEnrollment["repositories"]> | undefined, repository: NonNullable<ServiceEnrollment['repositories']>[number]): {
+    repositoryRoot: string;
+    repositoryId?: string;
+    providerRepositoryId?: string;
+}[];
+/**
+ * Build the service's live repository set from both explicit Zeye bindings and
+ * capture adapters installed on this machine. The result stays local: callers
+ * use roots only to open repository-scoped outboxes, while the wire contract
+ * receives hashes/canonical repository facts from captureRepositoryReference.
+ * Explicit enrollment bindings win so internal/provider IDs are preserved.
+ */
+export declare function discoverServiceRepositories(enrolled: NonNullable<ServiceEnrollment["repositories"]> | undefined, hostConfig: LocalHostConfig, fallbackRepositoryRoot?: string): NonNullable<ServiceEnrollment['repositories']>;
+export declare function serviceFiles(repositoryRoot: string, environment?: NodeJS.ProcessEnv, os?: NodeJS.Platform, machineHost?: boolean): ServiceFiles;
+export declare function hostServiceFiles(environment?: NodeJS.ProcessEnv, os?: NodeJS.Platform): ServiceFiles;
 export declare function serviceDefinition(files: ServiceFiles, repositoryRoot: string, nodePath: string, cliPath: string): string;
 export declare function installCaptureService(input: {
     repositoryRoot: string;
@@ -23,6 +43,13 @@ export declare function installCaptureService(input: {
     nodePath?: string;
     os?: NodeJS.Platform;
 }): Promise<ServiceFiles>;
+export declare function installCaptureHostService(input: {
+    enrollment: ServiceEnrollment;
+    cliPath: string;
+    nodePath?: string;
+    os?: NodeJS.Platform;
+}): Promise<ServiceFiles>;
 export declare function uninstallCaptureService(repositoryRoot: string, os?: NodeJS.Platform): Promise<ServiceFiles>;
+export declare function uninstallCaptureHostService(os?: NodeJS.Platform): Promise<ServiceFiles>;
 export declare function readServiceEnrollment(path: string): Promise<ServiceEnrollment>;
 export declare function applyServiceEnrollment(enrollment: ServiceEnrollment): void;